Data retrieval method, device and equipment

Abstract

The invention discloses a data retrieval method and device, and relates to the field of computers. The method is applied to a server, the server comprises a plurality of entries arranged into a first matrix, and the method comprises the steps that a query request of a client is received, the query request comprises a first homomorphic ciphertext, and a plaintext of the first homomorphic ciphertext is used for representing the position of a to-be-queried entry in the first matrix; in response to the query request, converting the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of the second homomorphic ciphertext being capable of representing the position of the to-be-queried entry in a second matrix, and the second matrix being obtained by converting the entry position of the first matrix; performing operation on a plaintext vector obtained by encoding entries of the second matrix and a second homomorphic ciphertext to obtain a ciphertext of the to-be-queried entry; and sending the ciphertext of the to-be-queried entry to the client.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data retrieval method, apparatus, and device. Background Technology

[0002] Private information retrieval (PIR) protocols allow clients to query entries in a server's database without the server knowing the indexes or keywords being queried. PIR is widely used in various covert query scenarios, such as finance and medicine, and is one of the most widely applied technologies in privacy computing today.

[0003] Typically, a stateful PIR protocol can be used between the client and server. Specifically, during the preprocessing phase, the client needs to maintain a local state hint pre-sent by the server. This hint usually includes information instructing the client on how to locate the target data index, information on masking techniques for obfuscating queries, and relevant access control information. If the data is stored on different servers, the hint should also include information describing how the data is segmented. In this way, the client bases subsequent online queries on this state, thereby achieving more efficient online queries.

[0004] However, stateful PIR protocols often have very high communication costs. This is because the hints downloaded and maintained by the client during the processing phase are often tens of megabytes (MB), and each subsequent online query also requires hundreds of kilobytes (KB), resulting in excessive communication overhead. Furthermore, stateful PIR protocols may involve complex encryption algorithms and computational processes. For example, when the client performs keyword-based searches, if the database storage volume is very large (e.g., millions of records), the server needs significant computing power to perform encrypted computations on the query ciphertext, incurring substantial computational costs. Summary of the Invention

[0005] This application provides a data retrieval method, apparatus, device, computer storage medium, and computer program product that can achieve stateless and efficient privacy information retrieval, achieving a balance between computational and communication overhead.

[0006] In a first aspect, embodiments of this application provide a data retrieval method. The method is applied to a server, which includes several entries arranged in a first matrix. The method includes: receiving a query request from a client, the query request including a first homomorphic ciphertext, the plaintext of which is used to characterize the position of the query entry in the first matrix; responding to the query request, transforming the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of which can characterize the position of the query entry in the second matrix, the second matrix being obtained by transforming the positions of the entries in the first matrix; performing a calculation on the plaintext vector obtained by encoding the entries in the second matrix with the second homomorphic ciphertext to obtain the ciphertext of the query entry; and sending the ciphertext of the query entry to the client.

[0007] In this embodiment, the server arranges the entries in a matrix (i.e., the first matrix). When a client queries, it can initiate a request using the coordinates (row and column positions) of the entry within the matrix. The server also reconstructs a second matrix to obfuscate the original entry positions. Then, it transforms the homomorphically encrypted index information (i.e., the first homomorphic ciphertext) in the client request in an encrypted state, thereby calculating the ciphertext of the desired entry within the second matrix. In this way, the server does not require the client to maintain a local hint state, significantly reducing the communication volume between them. Furthermore, since the server performs homomorphic encryption calculations based on the entry's position in the database's entry matrix, the computational logic complexity is low, reducing computational overhead and achieving a balance between communication and computational costs while improving query efficiency.

[0008] For example, this method may include: receiving a query request from a client, the query request being used to request a query for a target entry based on index information, the index information including homomorphic ciphertexts of a first one-hot vector and a second one-hot vector, the valid elements in the first one-hot vector and the valid elements in the second one-hot vector respectively corresponding to the positions of the target entry in a first matrix along a first dimension and a second dimension; the first dimension and the second dimension being one of rows and one of columns respectively; rotating and transforming the homomorphic ciphertexts of the first one-hot vector and / or the second one-hot vector; performing multiplication and addition operations on the rotated and transformed homomorphic ciphertexts of the first one-hot vector and / or the second one-hot vector with the vectors encoded by each entry in a second matrix to obtain the homomorphic ciphertext of the target entry; the second matrix being obtained by rearranging the first matrix, the rearrangement corresponding to the rotation and transformation; and sending the homomorphic ciphertext of the target entry to the client.

[0009] In this way, based on the characteristics of homomorphic encryption, specifically through the homomorphism of its supported operations such as rotation and multiplication, the index information in the encrypted state is used to perform indiscriminate calculations with each entry in the matrix, and finally the ciphertext of the target entry is obtained, thus achieving the purpose of PIR query.

[0010] In some implementations, the first homomorphic ciphertext includes row homomorphic ciphertext and column homomorphic ciphertext, the plaintext of the row homomorphic ciphertext and the plaintext of the column homomorphic ciphertext are used to represent the row and column where the query entry is located, respectively; in response to the query request, the first homomorphic ciphertext is transformed to obtain the second homomorphic ciphertext, including: in response to the query request, rotating the row homomorphic ciphertext and / or the column homomorphic ciphertext according to the transformation rules from the first matrix to the second matrix to obtain the second homomorphic ciphertext.

[0011] Thus, based on the characteristics of homomorphic encryption, the rotation operation it supports actually performs an ordered transformation of the elements in the plaintext corresponding to the ciphertext in the encrypted state. After the transformation, the positions represented by the elements in the encrypted state also change, becoming the positions of the corresponding entries in the second matrix. However, the transformed state remains encrypted (i.e., the second homomorphic ciphertext), thus preventing the server from obtaining the query information.

[0012] In some implementations, in response to a query request, the first homomorphic ciphertext is transformed to obtain the second homomorphic ciphertext. Specifically, in response to a query request, if the second matrix is ​​obtained by extracting entries from the diagonal of the first matrix and arranging them as columns, the column homomorphic ciphertext is rotated to obtain at least one column-rotated ciphertext, such that the second homomorphic ciphertext formed by the column-rotated ciphertext and the row homomorphic ciphertext can represent the position of the query entry in the second matrix; if the second matrix is ​​obtained by extracting entries from the diagonal of the first matrix and arranging them as rows, the row homomorphic ciphertext is rotated to obtain at least one row-rotated ciphertext, such that the second homomorphic ciphertext formed by the row-rotated ciphertext and the column homomorphic ciphertext can represent the position of the query entry in the second matrix.

[0013] In this implementation, by making the reconstruction matrix correspond to the ciphertext transformation, the corresponding query is achieved while the computational logic complexity is low, which helps to reduce computational overhead and improve query efficiency.

[0014] In some implementations, before receiving a client's query request, the method includes: receiving a setting request; in response to the setting request, traversing a first matrix row by row and arranging the entries on the main diagonal of the first matrix into the first column of a second matrix; arranging the entries on each secondary diagonal parallel to the main diagonal into the remaining columns of the second matrix, wherein each remaining column also includes entries that are not in the same row and column as the entries on their respective secondary diagonals in the first matrix, so as to have the same number of entries as the first column; and encoding each column of entries in the second matrix into a plaintext vector.

[0015] In some implementations, both the first matrix and the second matrix are The matrix is ​​N, where N is the number of entries (N > 1); the plaintext of both the row-homomorphic ciphertext and the column-homomorphic ciphertext are one-hot vectors; in response to a query request, the first homomorphic ciphertext is transformed to obtain the second homomorphic ciphertext, including: in response to a query request, the column-homomorphic ciphertext is transformed... After several rotational transformations, we obtain... The column-wise ciphertext is rotated so that the column-wise homomorphic ciphertext and each column-wise rotated ciphertext are aligned with each column in the second matrix. The plaintext vector obtained by encoding the entries of the second matrix is ​​then processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. This process includes multiplying the column-wise homomorphic ciphertext and each column-wise rotated ciphertext by the plaintext vector of their respective aligned columns, and multiplying the sum of the products by the row-wise homomorphic ciphertext to obtain the ciphertext of the query entry.

[0016] In some implementations, before receiving a client's query request, the method includes: receiving a setting request; in response to the setting request, traversing the first matrix column by column and arranging the entries on the main diagonal of the first matrix as the first row of the second matrix; arranging the entries on each secondary diagonal parallel to the main diagonal as the remaining rows of the second matrix, wherein each remaining row also includes entries in a different row and column from the entries on the corresponding secondary diagonal in the first matrix, so as to have the same number of entries as the first row; and encoding each row of entries in the second matrix into a plaintext vector.

[0017] In some implementations, both the first matrix and the second matrix are The matrix is ​​N, where N is the number of entries (N > 1); the plaintext of both row-homomorphic ciphertext and column-homomorphic ciphertext is a one-hot vector; in response to a query request, the first homomorphic ciphertext is transformed to obtain the second homomorphic ciphertext, specifically including: in response to a query request, the row-homomorphic ciphertext is transformed... After several rotational transformations, we obtain... The row-wise ciphertext is rotated so that the row-wise homomorphic ciphertext and each row-wise rotated ciphertext are aligned with each row in the second matrix. The plaintext vector obtained by encoding the entries in the second matrix is ​​then processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. This process includes multiplying the row-wise homomorphic ciphertext and each row-wise rotated ciphertext by the plaintext vector of their respective aligned rows, and then multiplying the sum of the products by the column-wise homomorphic ciphertext to obtain the ciphertext of the query entry.

[0018] In some implementations, the server includes multiple storage buckets; each storage bucket includes several entries arranged in a first matrix, and a second matrix obtained by transforming the positions of the entries in the first matrix; the method specifically includes: receiving a client's query request for multiple query entries, the multiple query entries belonging to different storage buckets, the plaintext of the first homomorphic ciphertext being used to represent the position of each query entry in its respective first matrix in a preset order; responding to the query request, transforming the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of the second homomorphic ciphertext being able to represent the position of each query entry in its respective second matrix in a preset order; performing a calculation with the second homomorphic ciphertext on the plaintext vector obtained by encoding the entries of each second matrix in a preset order to obtain the ciphertext of the multiple query entries; and sending the ciphertext of the multiple query entries to the client.

[0019] In this implementation, in a database bucketed storage scenario, consistency of the matrix dimension can be used to support batch queries by the client, thereby improving query efficiency.

[0020] In some implementations, both the first matrix and the second matrix are The matrix is ​​N, where N is the number of entries, and N > 1. Before receiving a client's query request for a target entry, the method includes: receiving a setting request, the setting request including a first parameter, the first parameter describing the batch size that the server can support, and this first parameter being greater than... In response to the setup request, for any first square matrix, the entries located on the main diagonal of the first square matrix are arranged into a first group of entries in a second square matrix, and the entries on each secondary diagonal parallel to the main diagonal are arranged into the remaining entries of the second square matrix. Each entry group consists of one row or one column. Any remaining entry group also includes entries in a different row and column from the entries on the second diagonal of the first matrix, ensuring the number of entries in each group is equal to the number of entries in the first entry group. For all entries in the second matrix, entries are collected and encoded into plaintext vectors at preset intervals, where the preset interval is the first parameter and... The ratio of .

[0021] Secondly, embodiments of this application provide a data retrieval device applied to a server. The server includes several entries arranged in a first matrix. The device includes: a receiving module for receiving a query request from a client, the query request including a first homomorphic ciphertext, the plaintext of which represents the position of the query entry in the first matrix; a processing module for responding to the query request by transforming the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of which represents the position of the query entry in the second matrix, the second matrix being obtained by transforming the positions of the entries in the first matrix; the processing module is further configured to perform a calculation with the plaintext vector obtained by encoding the entries in the second matrix and the second homomorphic ciphertext to obtain the ciphertext of the query entry; and the processing module is further configured to send the ciphertext of the query entry to the client.

[0022] In some implementations, the first homomorphic ciphertext includes row homomorphic ciphertext and column homomorphic ciphertext, the plaintext of the row homomorphic ciphertext and the plaintext of the column homomorphic ciphertext are used to represent the row and column where the query entry is located, respectively; the processing module is specifically used to: in response to the query request, rotate the row homomorphic ciphertext and / or the column homomorphic ciphertext according to the transformation rules from the first matrix to the second matrix to obtain the second homomorphic ciphertext.

[0023] In some implementations, the processing module is specifically used to: respond to a query request, if the second matrix is ​​obtained by extracting entries from the diagonal of the first matrix and arranging them into columns, then rotate the column homomorphic ciphertext to obtain at least one column-rotated ciphertext, such that the second homomorphic ciphertext formed by the column-rotated ciphertext and the row homomorphic ciphertext can represent the position of the query entry in the second matrix; if the second matrix is ​​obtained by extracting entries from the diagonal of the first matrix and arranging them into rows, then rotate the row homomorphic ciphertext to obtain at least one row-rotated ciphertext, such that the second homomorphic ciphertext formed by the row-rotated ciphertext and the column homomorphic ciphertext can represent the position of the query entry in the second matrix.

[0024] In some implementations, the receiving module is further configured to: receive a setting request; the processing module is further configured to, in response to the setting request, traverse the first matrix row by row and arrange the entries on the main diagonal of the first matrix as the first column of the second matrix; the processing module is further configured to, arrange the entries on each secondary diagonal parallel to the main diagonal as the remaining columns of the second matrix, wherein each remaining column also includes entries that are not in the same row and column as the entries on the corresponding secondary diagonal in the first matrix, so as to have the same number of entries as the first column; the processing module is further configured to encode each column entry in the second matrix into a plaintext vector.

[0025] In some implementations, both the first matrix and the second matrix are The matrix is ​​N, where N is the number of entries (N > 1); the plaintext of both row-homomorphic ciphertext and column-homomorphic ciphertext is a one-hot vector; the processing module is specifically used to: respond to a query request and process the column-homomorphic ciphertext... After several rotational transformations, we obtain... The column-wise ciphertext is rotated so that the column-wise homomorphic ciphertext and each column-wise rotated ciphertext are aligned with each column in the second matrix. The plaintext vector obtained by encoding the entries of the second matrix is ​​then processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. This process includes multiplying the column-wise homomorphic ciphertext and each column-wise rotated ciphertext by the plaintext vector of their respective aligned columns, and multiplying the sum of the products by the row-wise homomorphic ciphertext to obtain the ciphertext of the query entry.

[0026] In some implementations, the receiving module is further configured to: receive a setting request; the processing module is further configured to, in response to the setting request, traverse the first matrix column by column and arrange the entries located on the main diagonal of the first matrix as the first row of the second matrix; the processing module is further configured to, arrange the entries on each secondary diagonal parallel to the main diagonal as the remaining rows of the second matrix, wherein each remaining row also includes entries that are in different rows and columns of the first matrix than the entries on their respective secondary diagonals, so that the number of entries is equal to the number of entries in the first row; the processing module is further configured to encode each row of entries in the second matrix into a plaintext vector.

[0027] In some implementations, both the first matrix and the second matrix are The matrix is ​​a set of columns, where N is the number of entries (N > 1); the plaintext of both row-homomorphic ciphertext and column-homomorphic ciphertext is a one-hot vector; the processing module is specifically used to: respond to a query request and process the row-homomorphic ciphertext... After several rotational transformations, we obtain... The row-wise ciphertext is rotated so that the row-wise homomorphic ciphertext and each row-wise rotated ciphertext are aligned with each row in the second matrix. The plaintext vector obtained by encoding the entries in the second matrix is ​​then processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. This process includes multiplying the row-wise homomorphic ciphertext and each row-wise rotated ciphertext by the plaintext vector of their respective aligned rows, and then multiplying the sum of the products by the column-wise homomorphic ciphertext to obtain the ciphertext of the query entry.

[0028] In some implementations, the server includes multiple storage buckets; each storage bucket includes several entries arranged in a first matrix, and a second matrix obtained by transforming the positions of the entries in the first matrix; the receiving module is used to: receive a client's query request for multiple query entries, the multiple query entries belonging to different storage buckets, and the plaintext of the first homomorphic ciphertext is used to represent the position of each query entry in its respective first matrix in a preset order; the processing module is also used to, in response to the query request, transform the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of the second homomorphic ciphertext being able to represent the position of each query entry in its respective second matrix in a preset order; the processing module is also used to, perform a calculation with the second homomorphic ciphertext by encoding the plaintext vectors of the entries in each second matrix in a preset order, to obtain the ciphertext of the multiple query entries; the processing module is also used to, send the ciphertext of the multiple query entries to the client.

[0029] In some implementations, both the first matrix and the second matrix are The matrix, where N is the number of entries, N > 1; the receiving device is further configured to: receive a setting request, the setting request including a first parameter, the first parameter being used to describe the batch processing capacity that the server can support, the first parameter being greater than... The processing module is further configured to, in response to a setting request, for any first square matrix, arrange the entries located on the main diagonal of the first square matrix into a first group of entries in a second square matrix, and arrange the entries on each secondary diagonal parallel to the main diagonal into the remaining entries of the second square matrix. Each entry group consists of one row or one column. Any remaining entry group also includes entries in a different row and column from the entries on the second diagonal of the first matrix, to make the number of entries equal to the number of entries in the first entry group. The processing module is further configured to, for all entries in the second matrix, collect and encode the entries into plaintext vectors at preset intervals, where the preset interval is the first parameter and... The ratio of .

[0030] Thirdly, embodiments of this application provide a server, including: at least one memory for storing a program; at least one processor for executing the program stored in the memory; wherein, when the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0031] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0032] Fifthly, embodiments of this application provide a computer program product, characterized in that, when the computer program product is run on a processor, it causes the processor to execute the method described in the first aspect or any possible implementation of the first aspect.

[0033] In a sixth aspect, embodiments of this application provide a chip, characterized in that it includes at least one processor and an interface; the at least one processor obtains program instructions or data through the interface; the at least one processor is used to execute program line instructions to implement the method described in the first aspect or any possible implementation of the first aspect.

[0034] It is understood that the beneficial effects of the second to sixth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the architecture of a data retrieval system provided in an embodiment of this application;

[0036] Figure 2 This is a schematic diagram illustrating a data retrieval process performed by a server, as provided in an embodiment of this application.

[0037] Figure 3 This is a schematic diagram illustrating a data retrieval process performed by a server, as provided in an embodiment of this application.

[0038] Figure 4 This is a schematic diagram illustrating a data retrieval process performed by a server, as provided in an embodiment of this application.

[0039] Figure 5 This is a table showing the experimental results of data retrieval performed by the server provided in this application embodiment;

[0040] Figure 6 This is an experimental result table of data retrieval provided by the server in this application embodiment;

[0041] Figure 7 This is a flowchart illustrating a data retrieval method provided in an embodiment of this application;

[0042] Figure 8 This is a flowchart illustrating a data retrieval method provided in an embodiment of this application;

[0043] Figure 9 This is a flowchart illustrating a data retrieval method provided in an embodiment of this application;

[0044] Figure 10 This is a flowchart illustrating a data retrieval method provided in an embodiment of this application;

[0045] Figure 11This is a flowchart illustrating a data retrieval method provided in an embodiment of this application;

[0046] Figure 12 This is a flowchart illustrating a data retrieval method provided in an embodiment of this application;

[0047] Figure 13 This is a schematic diagram of the structure of a data retrieval device provided in an embodiment of this application;

[0048] Figure 14 This is a schematic diagram of the structure of a chip provided in an embodiment of this application. Detailed Implementation

[0049] In this document, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The symbol " / " indicates that the related objects are in an "or" relationship; for example, A / B means A or B. In the description of the embodiments in this application, unless otherwise stated, "multiple" means two or more. For example, multiple processing units refer to two or more processing units; multiple elements refer to two or more elements.

[0050] To facilitate understanding of the technical solution of this application, some technical terms used in this document will be explained below.

[0051] Fully homomorphic encryption performs computations on plaintext by manipulating ciphertext, ensuring that ciphertext computations can be performed in an untrusted environment. Mainstream homomorphic algorithms, such as BFV (Brakerski-Fan-Vercauteren), BGV (Brakerski-Gentry-Vaikuntanathan), and the CKKS scheme (second-generation homomorphic algorithms), support addition, scalar multiplication, multiplication, and batch processing, but are not adept at nonlinear function computations. Third-generation homomorphic algorithms, such as TFHE, excel at supporting complex nonlinear operations but do not support batch processing.

[0052] Efficient Private Information Retrieval (PIR) protocols can be designed based on second-generation fully homomorphic encryption schemes that support batch processing. Batch processing means that one homomorphic ciphertext can simultaneously encrypt n messages (n depends on the specific homomorphic parameters). For example, ciphertext ct can encrypt plaintext vectors (m1, m2, ..., mn); if a homomorphic ciphertext is obtained by performing homomorphic addition and homomorphic multiplication between two ciphertexts, then its corresponding plaintext message is the bitwise addition and bitwise multiplication of the two plaintext vectors. In other words, if there is a plaintext vector pt1 = (m1, m2, ..., mn) encrypted with ciphertext ct1, and a plaintext vector pt2 = (d1, d2, ..., dn) encrypted with ciphertext ct2, then the plaintext message corresponding to the homomorphic ciphertext ct3 = HomAdd(ct1, ct2) is (m1+d1, m2+d2, ..., mn+dn); and the plaintext message corresponding to the ciphertext ct4 = HomMult(ct1, ct2) is (m1*d1, m2*d2, ..., mn*dn). Here, the symbols HomAdd and HomMult represent homomorphic addition and homomorphic multiplication, respectively. That is, one homomorphic addition and homomorphic multiplication can achieve the addition and multiplication of n plaintext messages. Therefore, the nature of batch processing allows for more efficient computation when processing large amounts of data.

[0053] Furthermore, homomorphic encryption supports rotation operations. For ciphertext ct, its corresponding plaintext vector is (m1, m2, ..., mn), then the rotated ciphertext ct_g = Rot(ct, g), g = 0, 1, ..., n-1; its corresponding plaintext vector is (m(g+1), m(g+2), ..., mn, m1, ..., mg), where Rot represents the rotation operation and g represents the position of rotation.

[0054] To achieve high efficiency in online privacy information retrieval and balance system computational and communication overhead, this application provides a data retrieval method. This method primarily involves constructing a matrix-based database and reconstructing the matrix using its diagonal. When a client queries an entry in the database matrix, it can perform homomorphic computation with the reconstructed matrix based on the entry's position within the matrix, thus completing the online query. In this way, the entire query process is stateless PIR, thereby reducing communication overhead and ensuring high performance of position-based homomorphic computation.

[0055] Next, the architecture of a data retrieval system provided in the embodiments of this application will be described.

[0056] Figure 1 The diagram shown is an architectural schematic of a data retrieval system provided in an embodiment of this application. Figure 1As shown, the data retrieval system 00 includes at least one client 10 and a server 20. The client 10 and the server 20 can be directly or indirectly connected through a wired network or a wireless network, which is not limited in this embodiment.

[0057] For example, client 10 can be an application running on a user-side terminal device, or it can be a web browser provided externally by the data retrieval system 00. The user-side terminal device can be, but is not limited to, a smartphone, tablet, laptop, or desktop computer.

[0058] For example, server 20 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, security services, and big data and artificial intelligence platforms. The number of servers 20 can be more or less, and this application embodiment does not limit this.

[0059] For example, the wired or wireless networks described above may use standard communication technologies and / or protocols, including but not limited to any combination of local area networks (LANs), metropolitan area networks (MANs), wide area networks (WANs), mobile networks, wired networks, private networks, or virtual private networks.

[0060] In some possible implementations, on the server 20 side of the data retrieval system 00, the database 210 of server 20 includes N (N≥1) entries. Server 20 can use the square root algorithm to maintain these N entries as a single... A matrix DB, not an N-dimensional vector. For example Figure 1 In the example shown, server 20 arranges 16 entries 0-15 into a 4×4 matrix DB. It should be understood that the number of entries in database 210 can be more than... Figure 1 The number of entries shown may be more or less; for ease of description, it will also be referred to below as... Figure 1 The example shown is a matrix DB, but this does not limit the embodiments of this application.

[0061] In this way, each entry in database 210 can be retrieved using its row and column information in matrix DB, such as retrieving entry 2 located in the first row and third column of matrix DB.

[0062] In this implementation, server 20 can also iterate through... For each consecutive group of entries (a column of entries can be considered a group of entries), extract the entries from each diagonal of matrix DB to reconstruct matrix DB′. The number of entries in the rows and columns of the reconstructed matrix DB′ is equal to the number of entries on the main diagonal of matrix DB, i.e., equal to the number of rows and columns of matrix DB. When the number of entries from any diagonal of matrix DB is not equal to the number of entries extracted from its main diagonal, padding is done with entries from different rows and columns than those from the diagonal, until a new matrix DB′ is formed. It should be understood that each entry is extracted only once.

[0063] For example, the process of reconstructing matrix DB into matrix DB′ can be as follows:

[0064] Server 20 first extracts the entries on the main diagonal of matrix DB as the first column of matrix DB′. Then it iterates column by column, extracting the entries on each secondary diagonal parallel to the main diagonal, so that the entries on each secondary diagonal form a column. When the number of entries on any secondary diagonal is not equal to the number of entries on the main diagonal, it is filled with entries from different rows and columns than the entries on that secondary diagonal, until a new matrix DB′ is formed.

[0065] For example. Figure 1 As shown, from matrix DB, entries 0, 5, 10, and 15 located on the main diagonal (gray area) are first extracted to form the first column of the new matrix DB'. Then, the server 20 iterates column by column, extracting entries 1, 6, and 11 from the adjacent secondary diagonal to form the second column of the new matrix DB'. This column differs from the first column of the new matrix DB' by one entry number, so entries in different rows and columns from the entries on the secondary diagonal are selected to fill the gap, i.e., entry 12. Similarly, the remaining entries on the secondary diagonal are extracted to form the third and fourth columns of the new matrix DB'.

[0066] Next, through batch processing, each column entry in the reconstructed matrix DB′, or in other words, each diagonal vector of the original matrix DB, is encoded into a plaintext vector. For example, entries 0, 5, 10, and 15 are encoded into a plaintext vector, entries 1, 6, 11, and 12 are encoded into a plaintext vector, and so on. Thus, in this example, based on the reconstructed matrix DB′ in database 210, we can obtain... A plaintext vector.

[0067] At this point, server 20 has essentially completed the database 210 setup operation. As can be seen from the above process, during the entire setup phase, server 20 does not calculate any hints, but only performs simple entry extraction and encoding operations. Thus, the client does not need to download and store any database information during the setup phase, which facilitates the subsequent implementation of stateless privacy information retrieval (PIR).

[0068] In this embodiment, please refer again. Figure 1 As shown, client 10 can use the row and column information (row, col) of the target entry in the original matrix DB as the retrieval value i, i.e., i = (row, col), and homomorphically encrypt this retrieval value i to obtain the homomorphic ciphertext ct_i, which is then encapsulated as a query request. This query request is sent to server 20 to request a query for the target entry in database 210. Server 20 performs a series of calculations based on the encrypted index (row, col) to obtain the encrypted return value ct_f(i), and then returns it to client 10. Throughout the entire retrieval process, the index and the return value are invisible to server 20, thereby protecting the user's privacy information during the online data query process.

[0069] In practical applications, the above Figure 1 The data retrieval system 00 shown can be implemented in software or in hardware.

[0070] Data retrieval system 00, as an example of a software functional unit, may include code running on computing instances. These computing instances may include at least one of a host, a virtual machine, and a container. Further, the aforementioned computing instances may be one or more. For example, data retrieval system 000 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed within the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0071] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0072] Next, the data retrieval principle of the embodiments of this application will be described in detail.

[0073] Please refer to some possible implementation methods. Figure 2As shown in the process, server 20 can pre-process matrix DB by traversing column by column in step S01, extracting entries from each diagonal of matrix DB to reconstruct matrix DB', and encoding each column entry in matrix DB' to obtain... Using plaintext vectors such as d_c1, d_c2, d_c3, and d_c4, the database 210 is configured. It should be understood that the process of reconstructing matrix DB′ can also be referenced above regarding... Figure 1 The description of the reconstructed matrix DB′ is not repeated here.

[0074] For example, continue to refer to Figure 2 When client 10 needs to perform a data query, client 10 can use the row and column information (row, col) of the entry in the original matrix DB as an index, and encode (row, col) into a dimension. One-hot encoding. That is, the dimensions of the row and column One-hot vectors obtained by index (row, col) encoding are equal to the row and column sizes of matrix DB, respectively, and only the element at the corresponding index (row, col) in the row and column One-hot vectors is 1, while all others are 0. For example, if a user wants to search... Figure 2 For the entry in the second row and first column of the matrix DB shown, the row One-Hot vector of the index (row, col) can be represented as "0100", and the column One-Hot vector can be represented as "1000". In this way, through One-Hot vector encoding, the position information of each entry is converted into a form that is easy to recognize and calculate, thereby improving the computational efficiency of online queries.

[0075] Next, client 10 homomorphically encrypts the row-One-Hot vector and column-One-Hot vector respectively, obtaining the row-homomorphic ciphertext ct_row and column-homomorphic ciphertext ct_col, and encapsulates them together into a query request before sending it to server 20. Thus, server 20, upon receiving the query request, will not know the encrypted search value i.

[0076] Continue to refer to Figure 2 In this embodiment, after receiving a query request from client 10, server 20 calculates the corresponding return values ​​for the row homomorphic ciphertext ct_row and the column homomorphic ciphertext ct_col. The calculation process can be as follows:

[0077] Server 20 can first copy the homomorphic ciphertext ct_col from the query request through step S02. Next, get We have three identical column-wise homomorphic ciphertexts, ct_col. Then, the first column-wise homomorphic ciphertext ct_col remains unchanged, while the remaining three column-wise homomorphic ciphertexts ct_col each undergo a rotation operation. That is, while maintaining the encrypted state, the elements in these three column-wise homomorphic ciphertexts ct_col that are "1" are shifted one position in sequence, ultimately resulting in... Different columns of homomorphic ciphertext. For example Figure 2 As shown, after three rotation operations, the ciphertext ct_col of the One-Hot vector "1000" in the query request is rotated to obtain the ciphertexts ct_col_R1, ct_col_R2, and ct_col_R3 of the three One-Hot vectors "0001", "0010", and "0100". In each rotation operation, the element "1" moves up one position.

[0078] Next, server 20 can use step S03 to... Each of the following different column homomorphic ciphertexts is associated with the reconstructed matrix DB′. Align and multiply the plaintext vectors. In other words, the first plaintext vector in the query request is aligned and multiplied. The result of this rotation is aligned with the (h+1)th plaintext vector of matrix DB′ and multiplied. It should be noted that when h=0, it refers to the 0th rotation of the column homomorphic ciphertext ct_col in the query request, which is the column homomorphic ciphertext ct_col itself. As a concrete example, when multiplying a column homomorphic ciphertext by a plaintext vector, the plaintext vector can be first encrypted into a homomorphic ciphertext before the multiplication operation. Thus, the ciphertext obtained by multiplying a column homomorphic ciphertext by a plaintext vector is the ciphertext of the vector obtained by multiplying the column One-Hot vector of the column homomorphic ciphertext by the plaintext vector, positionally. Therefore, this ciphertext retains the entries in the plaintext vector aligned with the "1" element in the column One-Hot vector.

[0079] For example, such as Figure 2As shown, the ciphertext ct_col of the One-Hot vector "1000" is rotated three times to obtain the homomorphic ciphertexts ct_col_R1, ct_col_R2, and ct_col_R3 of the three One-Hot vectors "0001", "0010", and "0100". Then, the ciphertext ct_col of the One-Hot vector "1000" is multiplied by the plaintext vector d_c1 obtained by encoding the first column entries 0, 5, 10, and 15 in matrix DB′. The resulting ciphertext x_c1 actually retains only the entry 0. Similarly, the ciphertext ct_col_R1 of the One-Hot vector "0001" is multiplied by the plaintext vector d_c2 obtained by encoding the second column entries 1, 6, 11, and 12 in matrix DB′. The resulting ciphertext x_c2 retains only the entry 12. Similarly, the product of each column of homomorphic ciphertext and the aligned plaintext vector is the result of the alignment multiplication of the corresponding column's One-Hot vector and the plaintext vector.

[0080] Therefore, after the above multiplication operation, server 20 obtains... The homomorphic ciphertext is multiplied by the aligned plaintext vectors, such as x_c1, x_c2, x_c3, and x_c4. Then, in step S04, these products x_c1, x_c2, x_c3, and x_c4 are added together (i.e., the corresponding vectors are added in pairs), resulting in a homomorphic ciphertext ct_0. This homomorphic ciphertext ct_0 contains entries 0, 4, 8, and 12. In this way, the homomorphic ciphertext ct_0 contains the target entry to be queried while obfuscating other non-target entries, thus achieving the purpose of concealing the retrieval value from the server 20.

[0081] Next, server 20 performs a multiplication operation between the homomorphic ciphertext ct_row and the homomorphic ciphertext ct_0 in step S05 to obtain a new homomorphic ciphertext ct_1. The plaintext of homomorphic ciphertext ct_1 is actually the bitwise multiplication of the row One-Hot vector in the current index (row, col) with the plaintext of homomorphic ciphertext ct_0. That is, the plaintext of homomorphic ciphertext ct_0 encodes entries 0, 4, 8, and 12, and its multiplication with the row One-Hot vector results in entry 4. Therefore, homomorphic ciphertext ct_1 is returned to client 10.

[0082] In this way, client 10 obtains the homomorphic ciphertext ct_1 and can decrypt the target entry corresponding to the current index (row, col), thus completing a single query. Throughout the query process, server 20 does not require client 10 to maintain local state hints, which can greatly reduce the amount of communication between the two. Server 20 performs homomorphic encryption calculations based on the position of the entry in the entry matrix of database 210. The computational logic complexity is low, which helps to reduce computational overhead and achieve a balance between communication and computational overhead while improving query efficiency.

[0083] In some possible implementations, the embodiments of this application may also be as follows: Figure 3 The illustrated process enables data retrieval, and this process is similar to... Figure 2 The difference in the process shown is that the server 20 side can also use the calculation method of grouping entries by row in the setup and entry query phases.

[0084] Specifically, such as Figure 3 As shown, during the setup phase, server 20 can iterate through... For each consecutive entry group (a row of entries can be considered as an entry group), first execute step S11 to extract the entries on the main diagonal of matrix DB as the first row of matrix DB'. Then, traverse downwards row by row, starting from the secondary diagonal adjacent to the main diagonal, extracting the entries on each secondary diagonal parallel to the main diagonal, so that the entries on each secondary diagonal form a row. When the number of entries on any secondary diagonal is not equal to the number of entries on the main diagonal, pad it with entries from different rows and columns than those on the secondary diagonal, until a new matrix DB' is formed. Next, encode each row of entries in matrix DB' into a plaintext vector, obtaining... A plaintext vector, for example Figure 3 The plaintext vectors d_r1 to d_r4 are shown.

[0085] In this implementation, after receiving the query request from client 10, server 20 continues to refer to... Figure 3 Server 20 can first copy the homomorphic ciphertext ct_row through step S12. Then perform rotation operations on each of them to obtain... Different lines of homomorphic ciphertext. For example Figure 3 As shown, after three rotation operations, the ciphertext ct_row of the row One-Hot vector "0100" in the query request is rotated to obtain the ciphertexts ct_row_R1 to ct_row_R3 of the three row One-Hot vectors "1000", "0001", and "0010". In each rotation operation, the element "1" moves up one position.

[0086] Then, server 20 can use step S13 to... Each of the following different row homomorphic ciphertexts is associated with the reconstructed matrix DB′. If the plaintext vectors are aligned and multiplied, then the product of each row's homomorphic ciphertext and its aligned plaintext vector is the result of the corresponding row's One-Hot vector multiplied by the plaintext vector. Therefore, server 20 adds these products x_r1 to x_r4 (i.e., the corresponding vectors are added in step S14) to obtain a homomorphic ciphertext ct_0, which contains entries 4, 5, 6, and 7. Thus, homomorphic ciphertext ct_0 contains the target entry while obfuscating other non-target entries, achieving the purpose of concealing the search value from server 20. Next, server 20 multiplies the column homomorphic ciphertext ct_col with homomorphic ciphertext ct_0 in step S15, resulting in homomorphic ciphertext ct_1, which contains the data of target entry 4. This homomorphic ciphertext ct_1 is then returned to client 10 for decryption, completing one single query.

[0087] In some possible implementations, the database 210 of server 20 may include multiple buckets. Data in the database 210 can be distributed into these buckets using a cuckoo hashing method, such that the entries distributed into each bucket form a matrix with an equal number of rows and columns. For example, each bucket may contain... The matrix is ​​used for data partitioning. It should be understood that the bucketing principle of Cuckoo Hash roughly includes the following: For any entry to be assigned to a bucket, the storage location of the entry can be determined through a hash function. If the desired storage location (such as the position in the first row and second column of the matrix for bucket 1) is already occupied, the existing entry at that position can be "kicked out," and the entry to be assigned can be inserted into that position. The "kicked out" entry is then repositioned to a position in the matrix of another bucket. If that position is also occupied, the "kicking out" operation is repeated until all entries are assigned to these buckets.

[0088] In this implementation, based on the aforementioned bucketed storage on the server 20 side, the online query of the client 10 can be implemented as follows: Figure 4 The process shown is similar to... Figure 2 The main difference in the process shown is that server 20 supports batch retrieval by client 10.

[0089] Next, with Figure 4 The example shown illustrates the process of client 10 requesting a batch retrieval from server 20.

[0090] like Figure 4 As shown, during the setup phase, server 20 can proceed as described above. Figure 1 or Figure 2The matrix reconstruction process shown follows a similar principle. In step S21, matrices DB1 and DB2 from buckets 1 and 2 of database 210 are extracted along their respective diagonals to form new matrices DB1′ and DB2′. It should be understood that... Figure 4 The image shows a matrix with only two buckets. In other examples, database 210 may include more buckets, and the matrix in each bucket may include fewer or more entries, but the principle of batch retrieval in these examples remains the same. Figure 4 similar.

[0091] In this embodiment, after reconstructing the matrix for each bucket, the server 20 can encode each column of the matrix into a plaintext vector at a preset interval. As a specific example, if the batch size n supported by the user-configured homomorphic parameters is greater than... Then preset interval Here, the homomorphic parameter refers to a parameter that satisfies the homomorphic property, ensuring that the decryption result after operating on the encrypted data is identical to the result obtained after performing the same operation on the original data. For example, n is typically... Integer multiples of.

[0092] For example, please refer to the following: Figure 4 Both bucket 1 and bucket 2 contain 4×4 matrices, i.e., N′=4. If the batch size n=32, then the preset interval L=8. That is, in each column of these buckets, every 8 items are encoded into a plaintext vector. Thus, the eight items 0, 5, 10, 15, 16, 21, 26 and 31 can be encoded into a plaintext vector d_c1, the eight items 1, 6, 11, 12, 17, 22, 27 and 28 can be encoded into a plaintext vector d_c2, and so on, to obtain 4 plaintext vectors.

[0093] In this embodiment, refer to Figure 4 Client 10 can determine the number of batch queries based on homomorphic parameters. For example, if the batch size n = 32, and server 20 encodes the entries of two columns into a plaintext vector, then client 10 can query two entries at a time. If client 10 wants to query the entry in the second row, first column of bucket 1 and the entry in the third row, first column of bucket 2, then the index at the first position can be encoded as a row One-Hot vector of "0100" and a column One-Hot vector of "1000". The index at the second position can be encoded as a row One-Hot vector of "0010" and a column One-Hot vector of "1000". The row One-Hot vectors of these two indexes are concatenated and encrypted into a row homomorphic ciphertext ct_row, and the column One-Hot vectors of these two indexes are concatenated and encrypted into a column homomorphic ciphertext ct_col. This is then encapsulated into a query request and sent to server 20.

[0094] Next, based on the received query request, server 20 first copies the homomorphic ciphertext ct_col from the column in the query request through step S22. And perform a rotation operation on each of the copied column homomorphic ciphertexts ct_col, for details please refer to the above regarding Figure 2 The descriptions of copy and rotation operations are omitted here. It should be noted that during rotation, each element of the One-Hot vector in the column homomorphic ciphertext ct_col is moved individually. For example, when the column homomorphic ciphertext ct_col undergoes its first rotation, both One-Hot vectors "1000" in the ciphertext are transformed into "0001".

[0095] Then, server 20 will rotate the [device] through step S23. Each column of homomorphic ciphertexts ct_col, ct_col_R1 to ct_col_R3 is respectively... The plaintext vectors d_c1 to d_c4 are aligned and multiplied, and then the resulting products x_c1 to x_c4 are accumulated through step S24 to obtain the homomorphic ciphertext ct_0. The execution principle of steps S23 and S24 is the same as described above. Figure 2 The same applies to S03 and S04, so I will not go into details.

[0096] Next, server 20 multiplies the homomorphic ciphertext ct_0 with the homomorphic ciphertext ct_row in the current query request through step S25 to obtain the homomorphic ciphertext ct_1, which is then returned to client 10. In this way, client 10 can decrypt the two entries to be queried, entry 4 and entry 24, from the homomorphic ciphertext ct_1, completing a batch query.

[0097] In this way, by storing data in buckets, server 20 can support stateless PIR batch queries by client 10, which greatly improves online query efficiency and reduces communication and computational overhead, thereby reducing the monetary cost of server 20. It should be understood that monetary cost (US cents) refers to the cost of using the server's Central Processing Unit (CPU) and the cost associated with server-side network traffic. Typically, server CPU usage costs can reach one cent per hour, and internet traffic costs nine cents per GB. Therefore, the applicant of this application also tested the performance of batch queries on a database of millions of fixed data entries. This test was conducted with a server-side database of millions of entries, each entry being 288 bytes, and batch sizes of 16, 64, and 256 retrieved by client 10, respectively. The test results are as follows: Figure 5As shown in Table 1, mPIR, VectorizedPIR, and PIRAN are all PIR protocols, FancyPIR represents the retrieval method of this embodiment, and b represents the batch size of the retrieval. Table 1 shows that, in terms of computational cost, during the setup phase, this embodiment reduces costs by approximately 1.9 times compared to the mPIR protocol, by two to three times compared to the VectorizedPIR protocol, and is slightly better than the PIRANA protocol. It also outperforms most protocols during the query phase, and significantly reduces communication overhead, by 25 to 104 times compared to the mPIR protocol and by 6 to 15 times compared to the PIRANA protocol. In summary, for a database of millions of records with a fixed entry size of 288 bytes, the data retrieval system demonstrates excellent performance under different batch retrieval conditions.

[0098] In addition, the applicant of this application also conducted performance tests on querying a database of millions of records in a fixed batch with different entry sizes. The tests targeted a server-side database of millions of records and a client-side batch query of 256 entries, with each entry ranging in size from 32B, 64B, 128B, 256B to 8KB. The test results are as follows: Figure 6 As shown in Table 2, for a scenario involving batch querying 256 items from a database of millions of records, this embodiment outperforms solutions such as mPIR, VectorizedPIR, and PIRAN in terms of communication, computation, and monetary costs for items smaller than 4KB.

[0099] In some possible implementations, such as Figure 7 As shown, when database 210 includes multiple buckets, server 20 can also arrange the matrices in each bucket in a similar manner. Figure 3 The reconstruction shown is a reconstruction in the form of rows arranged diagonally. However, compared to... Figure 3 The difference in the example shown is that, in this implementation, as Figure 7 In encoding the plaintext vector of the reconstructed matrix (step S31), each row entry in these buckets is encoded into a plaintext vector according to a preset interval L. For example, if the preset interval L = 8, then... Figure 5 The first row of the reconstructed matrix in the two buckets is encoded together into a vector d_r1, the two second rows are encoded into a vector d_r2, and so on. Correspondingly, when client 10 performs a batch query (taking the query for the entry in the second row, first column of bucket 1 and the entry in the third row, first column of bucket 2 as an example), server 20 copies and rotates the row homomorphic ciphertext ct_row in the query request through step S32, and then, together with the obtained ciphertext ct_row_R1~ct_row_R3, aligns and multiplies it with the plaintext vectors d_r1~d_r4 respectively through step S33. Figure 3Similarly, then, via S34, the products x_r1 to x_r4 are added to obtain a homomorphic ciphertext ct_0. This ciphertext ct_0 is then multiplied by the column homomorphic ciphertext ct_col in the query request, and the result ct_1 is returned to client 10. Thus, client 10 decrypts the target entry, completing a batch query. The details are not elaborated further.

[0100] In some possible implementations, for entries with large amounts of data, server 20 can also encode a row or column of the reconstruction matrix DB' into multiple associated plaintext vectors. Correspondingly, when client 10 requests a data query, server 20 copies and rotates the corresponding homomorphic ciphertext in the query request, then aligns each homomorphic ciphertext with multiple plaintext vectors and performs a series of subsequent calculations similar to the above principle. (See reference...) Figure 8 As shown, taking column entry coding as an example, for example... Figure 1 The 4×4 reconstruction matrix DB′ shown can encode two entries in each column into a plaintext vector. For example, entries 0 and 5 are encoded into a plaintext vector d1, and entries 10 and 15 are encoded into a plaintext vector d2. d1 and d2 are associated, and the other three columns are similarly encoded. Thus, when server 20 performs similar operations... Figure 2 The query calculation shown aligns a column of homomorphic ciphertext with the two associated plaintext vectors and multiplies them. For example, the column of homomorphic ciphertext for the vector "1000" is aligned with d1 and d2 and multiplied. This also allows the calculation of the expected return value, which is returned to the client as 10.

[0101] Next, based on the content described above, a data retrieval method provided by an embodiment of this application will be introduced. It is understood that this method is proposed based on the content described above, and some or all of the content of this method can be found in the description above.

[0102] Please see Figure 9 , Figure 9 This is a flowchart illustrating a data retrieval method provided in an embodiment of this application. It is understood that this method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. The following description uses... Figure 1 Taking the execution on server 20 as an example, server 20 includes several entries arranged as a first matrix DB, which can be queried by client 10. Server 20 also pre-reconstructs the first matrix DB into a second matrix DB′, specifically as described above. Figure 2 or Figure 3 The positions of entries in the first matrix DB can be transformed in a manner described above to obtain the second matrix DB′, but this is not limited to this. Figure 9 As shown, the method may include:

[0103] S901, Receive a query request from the client. The query request includes a first homomorphic ciphertext. The plaintext of the first homomorphic ciphertext is used to represent the position of the query entry in the first matrix.

[0104] In this embodiment, client 10 can request at least one item to be queried from server 20 through a query request, which can also be the target item. The query index of client 10 is the position information of the target item in the first matrix DB. This index information is encrypted into a homomorphic ciphertext, namely the first homomorphic ciphertext. This prevents server 20 from directly obtaining the index and also facilitates subsequent query calculations based on the homomorphism of the query request, ensuring information confidentiality while simplifying the complexity of the calculation logic.

[0105] For example, the first homomorphic ciphertext may specifically include row homomorphic ciphertext and column homomorphic ciphertext. The row homomorphic ciphertext is obtained by homomorphically encrypting the One-Hot vector representing the row where the query entry is located, and the column homomorphic ciphertext is obtained by homomorphically encrypting the One-Hot vector representing the column where the query entry is located.

[0106] S902, in response to the query request, transform the first homomorphic ciphertext to obtain the second homomorphic ciphertext.

[0107] In this embodiment, in response to the query request, server 10 can first transform the first homomorphic ciphertext in the query request, so that the plaintext of the transformed second homomorphic ciphertext can represent the position of the query item in the second matrix. That is, since the items are all plaintext data on the server 20 side, in order to prevent server 20 from directly indexing the target item from the first matrix DB according to the query request, this embodiment reconstructs a second matrix DB' to obfuscate the positions of related items, and performs a corresponding transformation on the first homomorphic ciphertext in the query request, so that the original query request can still index the target item.

[0108] For example, if server 20 reconstructs the second matrix DB′ by extracting the diagonal, a selection operation can be used when transforming the first homomorphic ciphertext. In this way, based on the properties of the homomorphic ciphertext, the position of the elements in the ciphertext can be changed in the encrypted state, so that the plaintext of the obtained second homomorphic ciphertext can correspond to the position of the target entry in the second matrix DB′.

[0109] S903, the plaintext vector obtained by encoding the entries of the second matrix is ​​operated on with the second homomorphic ciphertext to obtain the ciphertext of the entry to be queried.

[0110] In this embodiment, the server 20 can perform a preset algorithm operation on the transformed second homomorphic ciphertext and the plaintext vector obtained by encoding the second matrix DB′ by row or column, thereby calculating the query entry from the second matrix DB′ based on the position represented by the plaintext of the second homomorphic ciphertext, and the query entry is in encrypted state.

[0111] For example, if the first homomorphic ciphertext is an indexed row and column One-Hot vector, then the resulting second homomorphic ciphertext is also in the form of a row and column One-Hot vector. The preset algorithm can be addition and / or multiplication operations. Since homomorphic ciphertexts are homomorphic under these operations—meaning the result of the operation between ciphertexts is equal to the same operation performed on their corresponding plaintexts—the operation between the second homomorphic ciphertext and the corresponding plaintext vector can actually be achieved by converting the plaintext vector into homomorphic ciphertext and then performing multiplication and / or addition operations with the second homomorphic ciphertext. The result of these two ciphertext operations is also ciphertext, and the plaintext of this ciphertext is the result of the operation between the second homomorphic ciphertext One-Hot vector and the plaintext vector. Therefore, the vector corresponding to the element "1" in the second homomorphic ciphertext is ultimately retained, yielding the encrypted query entry.

[0112] S904, send the encrypted text of the entry to be queried to the client.

[0113] In this embodiment, server 20 calculates the ciphertext of the query entry and returns it to client 10. Client 10 then obtains this homomorphic ciphertext and decrypts the target entry corresponding to the current index, thus completing a single query. Throughout the query process, server 20 does not require client 10 to maintain a local hint state, significantly reducing the amount of communication between them. Server 20 performs homomorphic encryption calculations based on the entry's position in the entry matrix of database 210, resulting in lower computational complexity and reduced computational overhead. This achieves a balance between communication and computational costs while improving query efficiency.

[0114] Next, possible implementations of the embodiments of this application will be described. It should be understood that these implementations are only examples and not limitations of this application.

[0115] Among some possible implementations, Figure 10 A flowchart illustrating a data retrieval method provided in an embodiment of this application is shown. Figure 10 As shown, the method may specifically include:

[0116] S1001, Receive setting request.

[0117] In this embodiment, maintenance personnel can maintain and manage the server 20 through a terminal device, input a setting request, and cause the server 20 to perform the corresponding matrix reconstruction operation to complete the configuration of the matrix in the database 210 during the setting phase.

[0118] For example, the setup request may include some configuration parameters to describe the matrix reconstruction method (e.g., traversing row by row or column by column to extract diagonal entries), the number of rows and columns of the matrix, the preset interval for encoding plaintext vectors after reconstructing the matrix, etc., but is not limited to these.

[0119] S1002, in response to the setting request, traverse the first matrix row by row, and arrange the entries located on the main diagonal of the first matrix into the first column of the second matrix.

[0120] In this embodiment, if the setting request instructs the server 20 to traverse the matrix DB row by row to extract diagonal entries, the server 20 responds by traversing the first matrix DB row by row, first extracting the entries on the main diagonal (i.e., the diagonal where the first row and first column entries are located) and arranging them as the first column of the second matrix DB′.

[0121] S1003, arrange the entries on each of the secondary diagonals parallel to the main diagonal into the remaining columns of the second matrix, wherein each remaining column also includes entries that are not in the same row and column as the entries on the corresponding secondary diagonal in the first matrix, so that the number of entries in the first column is equal to the number of entries in the first column.

[0122] In this embodiment, after obtaining the first column of the second matrix DB′, the diagonal containing the entries in the second column of the first row, the diagonal containing the entries in the third column of the first row, and so on, is extracted row by row. The entries on these secondary diagonals, parallel to the main diagonal, are then arranged sequentially to form the remaining columns of the second matrix DB′. Since the number of entries on the secondary diagonals is not equal to the number of entries on the main diagonal, to form a matrix, for any remaining column of the second matrix DB′, entries can be extracted from entries on the secondary diagonals that are neither in the same row nor the same column in the first matrix DB, ensuring that the number of entries equals the number of entries in the first column of the second matrix DB′, thus completing the construction of the new matrix DB′.

[0123] S1004, encode each column entry in the second matrix into a plaintext vector.

[0124] In this embodiment, after obtaining the second matrix DB′, each column entry in the second matrix DB′ can be encoded into a plaintext vector at a preset interval according to the setting request or default value. In this example, each column is encoded into a separate plaintext vector. Thus, The second matrix DB′ can be obtained A plaintext vector is used to obfuscate the positions of entries in the first matrix DB.

[0125] For example, the execution process of S1001 to S1004 described above can also refer to the above-mentioned... Figure 2 The principle of step S01 will not be repeated here.

[0126] In this implementation, the way server 20 reconstructs the matrix during the setup phase corresponds to its method of calculating the ciphertext in the query request during the response phase. For example, if diagonal entries are extracted column by column, the row position of the entry itself remains unchanged; if diagonal entries are extracted row by row, the column position of the entry itself remains unchanged. Therefore, the column or row information in the query request is transformed according to the matrix reconstruction method to efficiently find the query entry in the second matrix DB'. For details, please refer to [link / reference]. Figure 10 As shown, after completing the settings in S1001 to S1004 above, this method may further include:

[0127] S1005 receives the client's query request.

[0128] This step can be referred to the description of S901 above, and will not be repeated here. For example, the first homomorphic ciphertext in the query request may include a row homomorphic ciphertext and a column homomorphic ciphertext of an index. The plaintext of the row homomorphic ciphertext is a one-hot vector representing the row where the query entry is located, and the plaintext of the column homomorphic ciphertext is a one-hot vector representing the column where the query entry is located.

[0129] S1006, In response to the query request, perform column homomorphic ciphertext processing. After several rotational transformations, we obtain... Each column is rotated ciphertext to align the column homomorphic ciphertext and each column rotated ciphertext with each column in the second square matrix, the second homomorphic ciphertext including the row homomorphic ciphertext, the column homomorphic ciphertext, and the column rotated ciphertext.

[0130] In this embodiment, corresponding to the way the server 20 reconstructs the matrix DB′ of the database 210, during the response phase to the query request, based on the characteristics of homomorphic ciphertext, the row homomorphic ciphertext can be kept unchanged, while the column homomorphic ciphertext is selected and transformed in the encrypted state, so that the rotated column homomorphic ciphertext together with the row homomorphic ciphertext can represent the position of the query entry in the second matrix DB′.

[0131] For example, server 20 can perform column homomorphic ciphertext processing. After several rotational transformations, we obtain... Each column rotation ciphertext, with each rotation operation equivalent to moving the column position represented by the column homomorphic ciphertext by one position. Thus, after the column homomorphic ciphertext and each column rotation ciphertext (homomorphic) are aligned with each column in the second matrix, one of the column homomorphic ciphertexts and each column rotation ciphertext will be able to locate the query entry together with the row homomorphic ciphertext in the query request.

[0132] S1007, multiply the column homomorphic ciphertext and each column rotated ciphertext by the plaintext vector of their respective aligned columns, and multiply the sum of the products by the row homomorphic ciphertext to obtain the ciphertext of the query entry.

[0133] In this embodiment, the plaintext of both the column homomorphic ciphertext and the column rotated ciphertext is a One-Hot vector. Therefore, after the server 20 multiplies the row homomorphic ciphertext and the column rotated ciphertext with the plaintext vector of their respective aligned columns, the four products obtained are actually the positions corresponding to the element "1" in the One-Hot vector. These products are then accumulated and multiplied by the row homomorphic ciphertext to obtain the ciphertext of the query item.

[0134] Still with Figure 2 In the example shown, client 10 queries the entry in the second row, first column. Server 20 can perform three rotations on the column homomorphic ciphertext ct_col in the query request, and then multiply the column homomorphic ciphertext ct_col with the ciphertexts ct_col_R1, ct_col_R2, and ct_col_R3 obtained from the three rotations. What is retained are the entries at the positions corresponding to elements of "1" in the One-Hot vector of these ciphertexts. Therefore, multiplying the accumulated result of these products with the row homomorphic ciphertext yields the ciphertext of the query entry, which is the entry to be queried in the specified row found from the entries at these positions.

[0135] S1008, send the encrypted text of the entry to be queried to the client.

[0136] The execution principle of this step can be found in the relevant description of step S904 above.

[0137] In this way, server 20 obfuscates the original positions of entries by pre-reconstructing the matrix. When client 10 subsequently requests a query based on the entry's position, server 20 only needs to perform simple rotation, addition, and multiplication operations on the homomorphic ciphertext of rows and columns in the query request. This allows it to calculate the encrypted query entry from the reconstruction matrix without decrypting the ciphertext of the query request. The computational complexity is low, reducing computational overhead. Furthermore, throughout the query process, server 20 and client 10 do not need to maintain pre-configured local state hints to determine information such as the concealment technique, further reducing communication overhead.

[0138] Among some possible implementations, Figure 11 A flowchart illustrating a data retrieval method provided in an embodiment of this application is shown. Figure 11 As shown, the method may specifically include:

[0139] S1101, Receive setting request.

[0140] This step is similar to the execution principle of S1001 above, and will not be repeated here.

[0141] S1102, in response to the setting request, traverse the first matrix column by column and arrange the entries located on the main diagonal of the first matrix into the first row of the second matrix.

[0142] In this embodiment, if the setting request instructs the server 20 to traverse the matrix DB column by column to extract diagonal entries, the server 20 responds by traversing the first matrix DB column by column, first extracting the entries on the main diagonal (i.e., the diagonal where the first row and first column entries are located) and arranging them as the first row of the second matrix DB′.

[0143] S1103, arrange the entries on each of the secondary diagonals parallel to the main diagonal into the remaining rows of the second matrix, wherein each remaining row also includes entries that are in different rows and columns of the first matrix than the entries on the corresponding secondary diagonal, so that the number of entries is equal to the number of entries in the first row.

[0144] In this embodiment, after obtaining the first row of the second matrix DB′, the diagonal of the first column of the second row, the diagonal of the first column of the third row, and so on, are extracted column by column. The entries on these secondary diagonals, parallel to the main diagonal, are then arranged to form the remaining rows of the second matrix DB′. Since the number of entries on the secondary diagonals is not equal to the number of entries on the main diagonal, to form a matrix, for any remaining row of the second matrix DB′, entries on the secondary diagonals of that remaining row can be extracted from entries in the first matrix DB that are neither in the same row nor the same column, to ensure that the number of entries equals the number of entries in the first row of the second matrix DB′, thus completing the construction of the new matrix DB′.

[0145] S1104, encode each entry in the second matrix into a plaintext vector.

[0146] In this embodiment, after obtaining the second matrix DB′, each entry in the second matrix DB′ can be encoded into a plaintext vector at a preset interval according to the setting request or default value. In this example, each row is encoded into a separate plaintext vector. Thus, The second matrix DB′ can be obtained A plaintext vector is used to obfuscate the positions of entries in the first matrix DB.

[0147] For example, the execution process of S1101 to S1104 described above can also refer to the above-mentioned... Figure 3 The principle of step S11 will not be repeated here.

[0148] Correspondingly, such as Figure 11As shown, after completing the settings in S1101 to S1104 above, this method may further include:

[0149] S1105 receives query requests from clients.

[0150] This step can be referred to in the description of S901 above, and will not be repeated here.

[0151] S1106, In response to the query request, perform homomorphic ciphertext processing on the row. After several rotational transformations, we obtain... Each row is rotated ciphertext so that the row homomorphic ciphertext and each row rotated ciphertext are aligned with each row in the second square matrix, respectively. The second homomorphic ciphertext includes row homomorphic ciphertext, column homomorphic ciphertext, and row rotated ciphertext.

[0152] In this embodiment, corresponding to the way the server 20 reconstructs the matrix DB′ of the database 210, during the response phase to the query request, based on the characteristics of homomorphic ciphertext, the column homomorphic ciphertext can be kept unchanged, while the row homomorphic ciphertext is selected and transformed in the encrypted state, so that the rotated row homomorphic ciphertext and the column homomorphic ciphertext together can represent the position of the query entry in the second matrix DB′.

[0153] For example, server 20 can perform line homomorphic ciphertext processing. After several rotational transformations, we obtain... Each row of the ciphertext is rotated, and each rotation operation is equivalent to moving the row position represented by the homomorphic ciphertext of that row by one position. Thus, after the homomorphic ciphertext of that row and the rotated ciphertexts of each row are aligned with the rows in the second matrix, one of the homomorphic ciphertexts of that row and the rotated ciphertexts of each row will be able to locate the query entry together with the column homomorphic ciphertext in the query request.

[0154] S1107, multiply the row homomorphic ciphertext and each row rotated ciphertext by the plaintext vector of the row to which they are aligned, and multiply the sum of the products by the column homomorphic ciphertext to obtain the ciphertext of the query entry.

[0155] In this embodiment, the plaintext of both the row homomorphic ciphertext and the row rotation ciphertext is a One-Hot vector. Therefore, after the server 20 multiplies the row homomorphic ciphertext and the row rotation ciphertext with the plaintext vector of their respective aligned rows, the four products obtained are actually the positions corresponding to the element "1" in the One-Hot vector. These products are then accumulated and multiplied by the column homomorphic ciphertext to obtain the ciphertext of the query item.

[0156] S1108, send the encrypted text of the entry to be queried to the client.

[0157] The execution principle of this step can be found in the relevant description of step S904 above.

[0158] Among some possible implementations, Figure 12 A flowchart illustrating a data retrieval method provided in an embodiment of this application is shown. Figure 10 As shown, the method may specifically include:

[0159] S1201, Receive setting request.

[0160] This step is similar to step S1001 above and will not be repeated. The setting request may include a first parameter, which describes the batch size n that the server 20 can support. This first parameter n can be greater than...

[0161] S1202, in response to the setting request, for any first square matrix, the entries located on the main diagonal of the first square matrix are arranged into a first entry group of a second square matrix, and the entries on each secondary diagonal parallel to the main diagonal are arranged into the remaining entries of the second square matrix. Each entry group consists of a row or a column.

[0162] In this embodiment, when the database 210 includes multiple storage buckets, the first matrix DB in each bucket can be reconstructed separately, and the reconstruction method is the same. For example, each first matrix can be traversed column by column and the diagonal entries can be extracted and arranged into the columns of the corresponding second matrix DB' in the manner described in S1002 above, or each first matrix can be traversed row by row and the diagonal entries can be extracted and arranged into the rows of the corresponding second matrix DB' in the manner described in S1102 above.

[0163] S1203, For all entries in the second matrix, collect the entries and encode them into plaintext vectors at preset intervals, where the preset interval is the first parameter and... The ratio of .

[0164] In this embodiment, after obtaining the second matrix DB′ for each bucket, all second matrices DB′ are encoded into plaintext vectors along either the row or column direction at a preset interval. Specifically, if the reconstructed matrix DB′ is obtained by extracting the diagonal line column by column, then the plaintext vector is encoded from the column direction; if the reconstructed matrix DB′ is obtained by extracting the diagonal line row by row, then the plaintext vector is encoded from the row direction.

[0165] For example, the execution process of S1201 to S1204 described above can also refer to the above-mentioned... Figure 4 Middle step S21 or Figure 7 The principle description of S31 will not be repeated here.

[0166] Correspondingly, continue to refer to Figure 12As shown, after completing the settings in S1201 to S1204 above, this method may further include:

[0167] S1204, Receive a query request from the client for multiple items to be queried.

[0168] This step is similar to the description in S1005 above and will not be repeated here. For example, multiple query entries belong to different storage buckets. The plaintext of the first homomorphic ciphertext in the query request is used to represent the position of each query entry in its respective first matrix according to a preset order. For instance, if the query request is for index 1 and index 2, and each index includes a row One-Hot vector and a column One-Hot vector, then the row-level homomorphic ciphertext of the first homomorphic ciphertext can be an ordered concatenation of these two row One-Hot vectors, with the concatenation order corresponding to the storage bucket order. Similarly, the column-level homomorphic ciphertext of the first homomorphic ciphertext can be an ordered concatenation of these two column One-Hot vectors.

[0169] S1205, in response to the query request, transform the first homomorphic ciphertext to obtain the second homomorphic ciphertext. The plaintext of the second homomorphic ciphertext can represent the position of each query item in its respective second matrix in a preset order.

[0170] In this embodiment, corresponding to the way the server 20 reconstructs the matrix DB′ of the database 210, during the response phase to the query request, based on the characteristics of homomorphic ciphertext, a selection and transformation operation can be performed on the first homomorphic ciphertext in the encrypted state, so that the second homomorphic ciphertext obtained by the rotation can maintain the original ciphertext representation order, so as to orderly represent the position of each query item in the second matrix DB′.

[0171] For example, if the reconstruction matrix is ​​traversed column by column and diagonal entries are extracted, then this response phase involves transforming the column homomorphic ciphertext in the first homomorphic ciphertext into... This is a rotation transformation. If the reconstruction matrix is ​​traversed row by row and diagonal entries are extracted, then this response stage involves performing a row-wise homomorphic ciphertext transformation on the first homomorphic ciphertext. Secondary rotation transformation

[0172] S1206, the plaintext vector obtained by encoding the entries of each second matrix in a preset order is operated with the second homomorphic ciphertext to obtain the ciphertext of multiple entries to be queried.

[0173] For example, the rotated ciphertext in the query request and the homomorphic ciphertext obtained from the rotation are aligned with the entry groups (rows or columns) of the second matrix in each bucket, and multiplied by the plaintext vector encoded from the aligned entry groups. The multipliers are then added together and multiplied by the ciphertext in the query request that has not been rotated, thereby obtaining the ciphertext of multiple query entries.

[0174] For example, the specific execution principle of this step can be found in [reference needed]. Figure 4 or Figure 7 The calculation process shown will not be repeated here.

[0175] S1207, send the encrypted text of the entry to be queried to the client.

[0176] The execution principle of this step can be found in the relevant description of step S1008 above.

[0177] In this way, by storing data in buckets, server 20 can support stateless PIR batch queries by client 10, which greatly improves online query efficiency and reduces communication and computational overhead, thereby reducing the monetary cost of server 20.

[0178] Based on the methods described in the above embodiments, this application provides an apparatus. Please refer to... Figure 13 , Figure 13 This is a schematic diagram of the structure of a data retrieval device provided in an embodiment of this application.

[0179] like Figure 13 As shown, the device 1300 can be applied to a server, which includes several entries arranged in a first matrix. The device 1300 may include a receiving module 1301 and a processing module 1302. The receiving module 1301 is used to receive a query request from a client, the query request including a first homomorphic ciphertext, the plaintext of which represents the position of the query entry in the first matrix. The processing module 1302 is used to respond to the query request by transforming the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of which represents the position of the query entry in a second matrix, which is obtained by transforming the positions of the entries in the first matrix. Furthermore, the processing module 1302 is also used to perform a calculation with the second homomorphic ciphertext, using the plaintext vector obtained by encoding the entries in the second matrix, to obtain the ciphertext of the query entry. The processing module 1302 is also used to send the ciphertext of the query entry to the client.

[0180] In some implementations, the first homomorphic ciphertext includes row homomorphic ciphertext and column homomorphic ciphertext, the plaintext of the row homomorphic ciphertext and the plaintext of the column homomorphic ciphertext are used to represent the row and column where the query entry is located, respectively; the processing module is specifically used to: in response to the query request, rotate the row homomorphic ciphertext and / or the column homomorphic ciphertext according to the transformation rules from the first matrix to the second matrix to obtain the second homomorphic ciphertext.

[0181] In some implementations, the processing module is specifically used to: respond to a query request, if the second matrix is ​​obtained by extracting entries from the diagonal of the first matrix and arranging them into columns, then rotate the column homomorphic ciphertext to obtain at least one column-rotated ciphertext, such that the second homomorphic ciphertext formed by the column-rotated ciphertext and the row homomorphic ciphertext can represent the position of the query entry in the second matrix; if the second matrix is ​​obtained by extracting entries from the diagonal of the first matrix and arranging them into rows, then rotate the row homomorphic ciphertext to obtain at least one row-rotated ciphertext, such that the second homomorphic ciphertext formed by the row-rotated ciphertext and the column homomorphic ciphertext can represent the position of the query entry in the second matrix.

[0182] In some implementations, the receiving module is further configured to: receive a setting request; the processing module is further configured to, in response to the setting request, traverse the first matrix row by row and arrange the entries on the main diagonal of the first matrix as the first column of the second matrix; the processing module is further configured to, arrange the entries on each secondary diagonal parallel to the main diagonal as the remaining columns of the second matrix, wherein each remaining column also includes entries that are not in the same row and column as the entries on the corresponding secondary diagonal in the first matrix, so as to have the same number of entries as the first column; the processing module is further configured to encode each column entry in the second matrix into a plaintext vector.

[0183] In some implementations, both the first matrix and the second matrix are The matrix is ​​N, where N is the number of entries (N > 1); the plaintext of both row-homomorphic ciphertext and column-homomorphic ciphertext is a one-hot vector; the processing module is specifically used to: respond to a query request and process the column-homomorphic ciphertext... After several rotational transformations, we obtain... The column-wise ciphertext is rotated so that the column-wise homomorphic ciphertext and each column-wise rotated ciphertext are aligned with each column in the second matrix. The plaintext vector obtained by encoding the entries of the second matrix is ​​then processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. This process includes multiplying the column-wise homomorphic ciphertext and each column-wise rotated ciphertext by the plaintext vector of their respective aligned columns, and multiplying the sum of the products by the row-wise homomorphic ciphertext to obtain the ciphertext of the query entry.

[0184] In some implementations, the receiving module is further configured to: receive a setting request; the processing module is further configured to, in response to the setting request, traverse the first matrix column by column and arrange the entries located on the main diagonal of the first matrix as the first row of the second matrix; the processing module is further configured to, arrange the entries on each secondary diagonal parallel to the main diagonal as the remaining rows of the second matrix, wherein each remaining row also includes entries that are in different rows and columns of the first matrix than the entries on their respective secondary diagonals, so that the number of entries is equal to the number of entries in the first row; the processing module is further configured to encode each row of entries in the second matrix into a plaintext vector.

[0185] In some implementations, both the first matrix and the second matrix are The matrix is ​​a set of columns, where N is the number of entries (N > 1); the plaintext of both row-homomorphic ciphertext and column-homomorphic ciphertext is a one-hot vector; the processing module is specifically used to: respond to a query request and process the row-homomorphic ciphertext... After several rotational transformations, we obtain... The row-wise ciphertext is rotated so that the row-wise homomorphic ciphertext and each row-wise rotated ciphertext are aligned with each row in the second matrix. The plaintext vector obtained by encoding the entries in the second matrix is ​​then processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. This process includes multiplying the row-wise homomorphic ciphertext and each row-wise rotated ciphertext by the plaintext vector of their respective aligned rows, and then multiplying the sum of the products by the column-wise homomorphic ciphertext to obtain the ciphertext of the query entry.

[0186] In some implementations, the server includes multiple storage buckets; each storage bucket includes several entries arranged in a first matrix, and a second matrix obtained by transforming the positions of the entries in the first matrix; the receiving module is used to: receive a client's query request for multiple query entries, the multiple query entries belonging to different storage buckets, and the plaintext of the first homomorphic ciphertext is used to represent the position of each query entry in its respective first matrix in a preset order; the processing module is also used to, in response to the query request, transform the first homomorphic ciphertext to obtain a second homomorphic ciphertext, the plaintext of the second homomorphic ciphertext being able to represent the position of each query entry in its respective second matrix in a preset order; the processing module is also used to, perform a calculation with the second homomorphic ciphertext by encoding the plaintext vectors of the entries in each second matrix in a preset order, to obtain the ciphertext of the multiple query entries; the processing module is also used to, send the ciphertext of the multiple query entries to the client.

[0187] In some implementations, both the first matrix and the second matrix are The matrix, where N is the number of entries, N > 1; the receiving device is further configured to: receive a setting request, the setting request including a first parameter, the first parameter being used to describe the batch processing capacity that the server can support, the first parameter being greater than... The processing module is further configured to, in response to a setting request, for any first square matrix, arrange the entries located on the main diagonal of the first square matrix into a first group of entries in a second square matrix, and arrange the entries on each secondary diagonal parallel to the main diagonal into the remaining entries of the second square matrix. Each entry group consists of one row or one column. Any remaining entry group also includes entries in a different row and column from the entries on the second diagonal of the first matrix, to make the number of entries equal to the number of entries in the first entry group. The processing module is further configured to, for all entries in the second matrix, collect and encode the entries into plaintext vectors at preset intervals, where the preset interval is the first parameter and... The ratio of .

[0188] It should be understood that the above-described device is used to execute the methods in the above embodiments. The implementation principle and technical effect of the corresponding program modules in the device are similar to those described in the above methods. The working process of the device can be referred to the corresponding process in the above methods, and will not be repeated here.

[0189] Based on the methods in the above embodiments, this application provides an electronic device. The electronic device may include: at least one memory for storing a program; and at least one processor for executing the program stored in the memory; wherein, when the program stored in the memory is executed, the processor executes the methods in the above embodiments.

[0190] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0191] Based on the methods in the above embodiments, this application provides a computer program product, characterized in that, when the computer program product is run on a processor, the processor executes the methods in the above embodiments.

[0192] Based on the methods described in the above embodiments, this application also provides a chip. Please refer to... Figure 14 , Figure 14 This is a schematic diagram of a chip structure provided in an embodiment of this application. Figure 14 As shown, chip 900 includes one or more processors 901 and interface circuitry 902. Optionally, chip 900 may also include a bus 903. Wherein:

[0193] The processor 901 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed through integrated logic circuits in the hardware of the processor 901 or through software instructions. The processor 901 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods and steps disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor.

[0194] The interface circuit 902 can be used to send or receive data, instructions or information. The processor 901 can use the data, instructions or other information received by the interface circuit 902 to process the data, instructions or other information, and can send the processed information out through the interface circuit 902.

[0195] Optionally, chip 900 also includes memory, which may include read-only memory and random access memory, and provides operation instructions and data to the processor. A portion of the memory may also include non-volatile random access memory (NVRAM).

[0196] Optionally, the memory stores executable software modules or data structures, and the processor can execute corresponding operations by calling the operation instructions stored in the memory (which may be stored in the operating system).

[0197] Optionally, the interface circuit 902 can be used to output the execution results of the processor 901.

[0198] It should be noted that the functions of the processor 901 and the interface circuit 902 can be implemented through hardware design, software design, or a combination of hardware and software; no restrictions are imposed here.

[0199] It should be understood that each step of the above method embodiments can be completed by hardware logic circuits or software instructions in a processor.

[0200] It is understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. In addition, in some possible implementations, each step in the above embodiments may be selectively executed according to the actual situation, and may be partially or fully executed, which is not limited here.

[0201] It is understood that the processor in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0202] The method steps in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0203] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0204] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

Claims

1. A data retrieval method, characterized in that, The method is applied to a server, the server comprising several entries arranged in a first matrix, the method comprising: Receive a query request from a client, the query request including a first homomorphic ciphertext, the plaintext of the first homomorphic ciphertext being used to characterize the position of the query entry in the first matrix; In response to the query request, the first homomorphic ciphertext is transformed to obtain the second homomorphic ciphertext. The plaintext of the second homomorphic ciphertext can represent the position of the query entry in the second matrix, which is obtained by transforming the entry positions of the first matrix. The plaintext vector obtained by encoding the entries using the second matrix is ​​processed with the second homomorphic ciphertext to obtain the ciphertext of the query entry. The encrypted text of the entry to be queried is sent to the client.

2. The method according to claim 1, characterized in that, The first homomorphic ciphertext includes row homomorphic ciphertext and column homomorphic ciphertext, wherein the plaintext of the row homomorphic ciphertext and the plaintext of the column homomorphic ciphertext are used to represent the row and column where the query entry is located, respectively. The step of transforming the first homomorphic ciphertext to obtain the second homomorphic ciphertext in response to the query request includes: In response to the query request, the row homomorphic ciphertext and / or the column homomorphic ciphertext are rotated according to the transformation rules from the first matrix to the second matrix to obtain the second homomorphic ciphertext.

3. The method according to claim 2, characterized in that, In response to the query request, transforming the first homomorphic ciphertext to obtain the second homomorphic ciphertext specifically includes: In response to the query request, if the second matrix is ​​obtained by extracting the entries on the diagonal of the first matrix and arranging them into columns, then the column homomorphic ciphertext is rotated to obtain at least one column rotated ciphertext, such that the second homomorphic ciphertext formed by the column rotated ciphertext and the row homomorphic ciphertext can characterize the position of the query entry in the second matrix. If the second matrix is ​​obtained by extracting the entries on the diagonal of the first matrix and arranging them into rows, then the row homomorphic ciphertext is rotated to obtain at least one row rotated ciphertext, such that the second homomorphic ciphertext formed by the row rotated ciphertext and the column homomorphic ciphertext can characterize the position of the query entry in the second matrix.

4. The method according to claim 2 or 3, characterized in that, Before receiving the client's query request, the method includes: Receive setup request; In response to the setting request, the first matrix is ​​traversed row by row, and the entries located on the main diagonal of the first matrix are arranged as the first column of the second matrix; The entries on each of the secondary diagonals parallel to the main diagonal are arranged as the remaining columns of the second matrix, wherein each of the remaining columns also includes entries that are in different rows and columns of the first matrix from the entries on their respective secondary diagonals, so that the number of entries in the remaining columns is equal to the number of entries in the first column. Each column entry in the second matrix is ​​encoded into a plaintext vector.

5. The method according to claim 4, characterized in that, Both the first matrix and the second matrix are √N×√N matrices, where N is the number of entries and N>1; the plaintext of the row homomorphic ciphertext and the column homomorphic ciphertext are both one-hot vectors. The step of transforming the first homomorphic ciphertext to obtain the second homomorphic ciphertext in response to the query request includes: In response to the query request, the column homomorphic ciphertext is rotated √N-1 times to obtain √N-1 column rotated ciphertexts, so that the column homomorphic ciphertext and each of the column rotated ciphertexts are aligned with each column in the second matrix. The step of performing a calculation on the plaintext vector obtained by encoding the entries of the second matrix and the second homomorphic ciphertext to obtain the ciphertext of the query entry includes: The column homomorphic ciphertext and each of the column rotated ciphertexts are multiplied by the plaintext vector of their respective aligned columns, and the sum of the products is multiplied by the row homomorphic ciphertext to obtain the ciphertext of the query entry.

6. The method according to claim 2 or 3, characterized in that, Before receiving the client's query request, the method includes: Receive setup request; In response to the setting request, the first matrix is ​​traversed column by column, and the entries located on the main diagonal of the first matrix are arranged as the first row of the second matrix; The entries on each of the secondary diagonals parallel to the main diagonal are arranged as the remaining rows of the second matrix, wherein each of the remaining rows also includes entries that are in different rows and columns of the first matrix from the entries on their respective secondary diagonals, so that the number of entries is equal to the number of entries in the first row. Each entry in the second matrix is ​​encoded into a plaintext vector.

7. The method according to claim 6, characterized in that, Both the first matrix and the second matrix are √N×√N matrices, where N is the number of entries and N>1; the plaintext of the row homomorphic ciphertext and the column homomorphic ciphertext are both one-hot vectors. In response to the query request, transforming the first homomorphic ciphertext to obtain the second homomorphic ciphertext specifically includes: In response to the query request, the row homomorphic ciphertext is rotated √N-1 times to obtain √N-1 row rotated ciphertexts, so that the row homomorphic ciphertext and each row rotated ciphertext are aligned with each row in the second matrix. The step of performing a calculation on the plaintext vector obtained by encoding the entries of the second matrix and the second homomorphic ciphertext to obtain the ciphertext of the query entry includes: The row homomorphic ciphertext and each row rotated ciphertext are multiplied by the plaintext vector of their respective aligned rows, and the sum of the products is multiplied by the column homomorphic ciphertext to obtain the ciphertext of the query entry.

8. The method according to claim 1, characterized in that, The server includes multiple storage buckets; each storage bucket includes several entries arranged in the first matrix, and a second matrix obtained by changing the position of the entries in the first matrix; The method specifically includes: The system receives a query request from the client for multiple query entries, each of which belongs to a different storage bucket. The plaintext of the first homomorphic ciphertext is used to characterize the position of each query entry in its respective first matrix in a preset order. In response to the query request, the first homomorphic ciphertext is transformed to obtain the second homomorphic ciphertext. The plaintext of the second homomorphic ciphertext can represent the position of each query item in its respective second matrix according to the preset order. The plaintext vector obtained by encoding each entry of the second matrix in the preset order is operated with the second homomorphic ciphertext to obtain the ciphertext of the plurality of query entries; The encrypted text of the multiple entries to be queried is sent to the client.

9. The method according to claim 8, characterized in that, Both the first matrix and the second matrix are √N×√N matrices, where N is the number of the plurality of entries, and N>1; Before receiving a query request for a target entry from a client, the method includes: Receive a setting request, the setting request including a first parameter, the first parameter being used to describe the number of batches that the server can support, the first parameter being greater than √N; In response to the setting request, for any first square matrix, the entries located on the main diagonal of the first square matrix are arranged into a first entry group of the second square matrix, and the entries on each secondary diagonal parallel to the main diagonal are arranged into the remaining √N-1 entry groups of the second square matrix, wherein the entry group is a row or a column. Each of the remaining entry groups also includes entries that are in different rows and columns from the entries on the second diagonal in the first matrix, so that the number of entries in the first entry group is equal to the number of entries in the first entry group. For all entries in the second matrix, the entries are collected and encoded into plaintext vectors at preset intervals, where the preset interval is the ratio of the first parameter to √N.

10. A data retrieval device, characterized in that, The apparatus is applied to a server, the server comprising several entries arranged in a first matrix, the apparatus comprising: A receiving module is used to receive a query request from a client, wherein the query request includes a first homomorphic ciphertext, and the plaintext of the first homomorphic ciphertext is used to characterize the position of the query item in the first matrix; The processing module is configured to, in response to the query request, transform the first homomorphic ciphertext to obtain a second homomorphic ciphertext, wherein the plaintext of the second homomorphic ciphertext can characterize the position of the query entry in a second matrix, and the second matrix is ​​obtained by transforming the position of the entry in the first matrix; The processing module is further configured to perform a calculation on the plaintext vector obtained by encoding the entries of the second matrix and the second homomorphic ciphertext to obtain the ciphertext of the query entry; The processing module is also used to send the encrypted text of the entry to be queried to the client.

11. The apparatus according to claim 10, characterized in that, The first homomorphic ciphertext includes row homomorphic ciphertext and column homomorphic ciphertext, wherein the plaintext of the row homomorphic ciphertext and the plaintext of the column homomorphic ciphertext are used to represent the row and column where the query entry is located, respectively. The processing module is specifically used for: In response to the query request, the row homomorphic ciphertext and / or the column homomorphic ciphertext are rotated according to the transformation rules from the first matrix to the second matrix to obtain the second homomorphic ciphertext.

12. The apparatus according to claim 11, characterized in that, The processing module is specifically used for: In response to the query request, if the second matrix is ​​obtained by extracting the entries on the diagonal of the first matrix and arranging them into columns, then the column homomorphic ciphertext is rotated to obtain at least one column rotated ciphertext, such that the second homomorphic ciphertext formed by the column rotated ciphertext and the row homomorphic ciphertext can characterize the position of the query entry in the second matrix. If the second matrix is ​​obtained by extracting the entries on the diagonal of the first matrix and arranging them into rows, then the row homomorphic ciphertext is rotated to obtain at least one row rotated ciphertext, such that the second homomorphic ciphertext formed by the row rotated ciphertext and the column homomorphic ciphertext can characterize the position of the query entry in the second matrix.

13. The apparatus according to claim 11 or 12, characterized in that, The receiving module is also configured to: receive setting requests; The processing module is also configured to, in response to the setting request, traverse the first matrix row by row and arrange the entries located on the main diagonal of the first matrix as the first column of the second matrix; The processing module is further configured to arrange the entries on each secondary diagonal parallel to the main diagonal into the remaining columns of the second matrix, wherein each of the remaining columns also includes entries that are in different rows and columns of the first matrix from the entries on the corresponding secondary diagonal, so that the number of entries in the first column is equal to the number of entries in the first column. The processing module is also configured to encode each column entry in the second matrix into a plaintext vector.

14. The apparatus according to claim 13, characterized in that, Both the first matrix and the second matrix are √N×√N matrices, where N is the number of entries and N>1; the plaintext of the row homomorphic ciphertext and the column homomorphic ciphertext are both one-hot vectors. The processing module is specifically used for: In response to the query request, the column homomorphic ciphertext is rotated √N-1 times to obtain √N-1 column rotated ciphertexts, so that the column homomorphic ciphertext and each of the column rotated ciphertexts are aligned with each column in the second matrix. The step of performing a calculation on the plaintext vector obtained by encoding the entries of the second matrix and the second homomorphic ciphertext to obtain the ciphertext of the query entry includes: The column homomorphic ciphertext and each of the column rotated ciphertexts are multiplied by the plaintext vector of their respective aligned columns, and the sum of the products is multiplied by the row homomorphic ciphertext to obtain the ciphertext of the query entry.

15. The apparatus according to claim 11 or 12, characterized in that, The receiving module is also used to: receive setting requests; The processing module is further configured to, in response to the setting request, traverse the first matrix column by column and arrange the entries located on the main diagonal of the first matrix as the first row of the second matrix; The processing module is further configured to arrange the entries on each secondary diagonal parallel to the main diagonal into the remaining rows of the second matrix, wherein each of the remaining rows also includes entries that are in different rows and columns of the first matrix from the entries on their respective secondary diagonals, so as to have the same number of entries as the first row. The processing module is further configured to encode each row entry in the second matrix into a plaintext vector.

16. The apparatus according to claim 15, characterized in that, Both the first matrix and the second matrix are √N×√N matrices, where N is the number of entries and N>1; the plaintext of the row homomorphic ciphertext and the column homomorphic ciphertext are both one-hot vectors. The processing module is specifically used for: In response to the query request, the row homomorphic ciphertext is rotated √N-1 times to obtain √N-1 row rotated ciphertexts, so that the row homomorphic ciphertext and each row rotated ciphertext are aligned with each row in the second matrix. The step of performing a calculation on the plaintext vector obtained by encoding the entries of the second matrix and the second homomorphic ciphertext to obtain the ciphertext of the query entry includes: The row homomorphic ciphertext and each row rotated ciphertext are multiplied by the plaintext vector of their respective aligned rows, and the sum of the products is multiplied by the column homomorphic ciphertext to obtain the ciphertext of the query entry.

17. The apparatus according to claim 10, characterized in that, The server includes multiple storage buckets; each storage bucket includes several entries arranged in the first matrix, and a second matrix obtained by changing the position of the entries in the first matrix; The receiving module is used to: receive the client's query request for multiple query entries, the multiple query entries belonging to different storage buckets, and the plaintext of the first homomorphic ciphertext is used to characterize the position of each query entry in its respective first matrix in a preset order; The processing module is further configured to, in response to the query request, transform the first homomorphic ciphertext to obtain the second homomorphic ciphertext, wherein the plaintext of the second homomorphic ciphertext can represent the position of each query item in its respective second matrix in the preset order. The processing module is further configured to perform a calculation with the second homomorphic ciphertext by encoding the plaintext vectors of each entry of the second matrix in the preset order to obtain the ciphertext of the plurality of query entries; The processing module is also used to send the encrypted text of the plurality of entries to be queried to the client.

18. The apparatus according to claim 17, characterized in that, Both the first matrix and the second matrix are √N×√N matrices, where N is the number of the plurality of entries, and N>1; The receiving device is further configured to: receive a setting request, the setting request including a first parameter, the first parameter being used to describe the number of batches that the server can support, the first parameter being greater than √N; The processing module is further configured to, in response to the setting request, for any first matrix, arrange the entries located on the main diagonal of the first matrix into a first entry group of the second matrix, and arrange the entries on each secondary diagonal parallel to the main diagonal into the remaining √N-1 entry groups of the second matrix, wherein the entry group is a row or a column. Each of the remaining entry groups also includes entries that are in different rows and columns from the entries on the second diagonal in the first matrix, so that the number of entries in the first entry group is equal to the number of entries in the first entry group. The processing module is further configured to collect and encode the entries into plaintext vectors for all entries in the second matrix at preset intervals, wherein the preset interval is the ratio of the first parameter to √N.

19. A server, characterized in that, The server includes a processor and memory; The processor is configured to execute instructions stored in the memory such that the processor performs the method as described in any one of claims 1-9.

20. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method as described in any one of claims 1-9.

21. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device cluster, the computing device cluster causes the computing device cluster to perform the method as described in any one of claims 1-9.

Images